Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
64
0

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
190
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
190
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
110
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
180
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
130
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
120
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
メルペイ 会計システム概要と歴史
Avatar for mewuto mewuto
0
150
生成AIで高い生産性を求められて、 悩み、乗り越えた話
Avatar for GO Inc. dev mot_techtalk
2
130
AI駆動開発、viviONの1年 ── うまくいったこと・いかなかったこと
Avatar for viviON vivion
0
260
AIは爆速なのに、私が詰まっていた話 ― 音声入力と鳴くマスコットでボトルネックを削る
Avatar for Yuuki Yamashita yama3133
0
520
自律型 AI をセキュアに実装！Gemini と MIG で作る動的コード実行環境
Avatar for Recruit recruitengineers
PRO
1
210
Oracle Base Database Service 技術詳細
Avatar for oracle4engineer oracle4engineer
PRO
17
120k
MCPゲートウェイを作って運用してわかったこと — Agent時代の権限管理の現在地
Avatar for k.muguruma mtpooh
10
3.1k
HolmesGPTで始めるSREエージェント入門！プラットフォームの障害調査はAIにお任せ 〜
Avatar for Tech Leverages leveragestech
PRO
0
150
Meet AgentCore Identity Consent Portal
Avatar for iganin hironobuiga
3
190
営業オントロジーの作り方と、エージェントからの辿り方 ── ナレッジワークの現場から
Avatar for KNOWLEDGE WORK / 株式会社ナレッジワーク kworkdev
PRO
1
270
契約書画像からの情報抽出に特化した視覚接地モデルを育てる話
Avatar for SansanTech sansantech
PRO
1
140
LLM機能を自作して分かるSnowflake Cortex AIの強み
Avatar for Nayuta S. nayuts
0
300

Featured

See All Featured
Agile Leadership in an Agile Organization
Avatar for Dr. Kim W Petersen kimpetersen
PRO
0
270
Designing for Performance
Avatar for Lara Hogan lara
611
70k
How to Get Subject Matter Experts Bought In and Actively Contributing to SEO & PR Initiatives.
Avatar for Liv Day livdayseo
0
210
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
Avatar for Stéphanie Walter stephaniewalter
287
14k
Effective software design: The role of men in debugging patriarchy in IT @ Voxxed Days AMS
Avatar for Kenny Baas-Schwegler baasie
1
550
Marketing Yourself as an Engineer | Alaka | Gurzu
Avatar for Gurzu gurzu
0
320
Code Review Best Practice
Avatar for Trisha Gee trishagee
74
20k
Hiding What from Whom? A Critical Review of the History of Programming languages for Music
Avatar for Tomoya Matsuura tomoyanonymous
3
1.3k
AI Search: Implications for SEO and How to Move Forward - #ShenzhenSEOConference
Avatar for Aleyda Solis aleyda
1
1.4k
Improving Core Web Vitals using Speculation Rules API
Avatar for Sergey Chernyshev sergeychernyshev
21
1.7k
Imperfection Machines: The Place of Print at Facebook
Avatar for Scott Boms scottboms
270
14k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
Avatar for mongodb mongodb
50
10k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and